Insecure Permissions Vulnerability in GenOffice HTTP MCP Server
CVE-2026-108582

6.8MEDIUM

Key Information:

Vendor

Genspark-ai

Status
Genoffice
Vendor
CVE Published:
10 October 2026

What is CVE-2026-108582?

An insecure permissions vulnerability exists in the HTTP MCP server of GenOffice versions up to 0.11.505. This flaw allows local unprivileged users to access and read uploaded documents and converted outputs via the world-readable genoffice-mcp-http directory, located under the system temporary directory. Attackers can take advantage of this misconfiguration to bypass the HTTP bearer token, leading to potential unauthorized exposure of sensitive information.

Affected Version(s)

GenOffice 0 <= 0.11.505

References

https://hackmd.io/@haind/genoffice-http-mcp-temp-file-dis...
third-party-advisory
https://github.com/genspark-ai/genoffice/blob/v0.11.505/p...
technical-description
https://github.com/genspark-ai/genoffice/releases/tag/v0....
productrelease-notes

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.